Bugfix in Omnipay/SagePay/Message/ServerCompleteCreateCardRequest signature calculation. The VPSTxId sent by sagepay for token creation notification is not the same as the VPSTxId returned to the initial create token call. the initial one has curly braces on it, the notification one does not. the notification one is used to calculate the notification signature
tweaks which helped during debugging